Integer Underflow Vulnerability in OpenPrinting CUPS Affecting Linux Systems

CVE-2026-39314

What is CVE-2026-39314?

OpenPrinting's CUPS (Common Unix Printing System) is vulnerable to an integer underflow issue found in the _ppdCreateFromIPP() function. This flaw permits unprivileged local users to crash the cupsd process by submitting a negative job-password-supported IPP attribute. The vulnerability exists due to insufficient bounds checking, allowing negative values to pass validation, leading to a SIGSEGV error when the invalid length is used in memory operations. As a result, attackers can exploit this to achieve a persistent denial of service, particularly when combined with systemd's restart on failure mechanism.

References